How do I find out what user created a VM?

[Box293]

vCenter 2.5 Update 4.

All users that login are active directory users.

How do I find out who created a VM from scratch / deployed a VM from a template.

I.E. I am visualising something like right click the VM and select properties and it shows you the creator / owner. A bit like windows file security advanced tab you can look at the owner.

[AndreTheGiant · Accepted solution]

There isn't a property like this.

But in VC log you can trace who have create/deploy a VM.

Andre

**if you found this or any other answer useful please consider allocating points for helpful or correct answers

[Box293]

I wonder how useful a log will be 6 months down the track, will the information still be there or will it be truncated?

Where exactly is the log located?

[VladN]

Full logs for a virtual machine are stored in the same folder as vmx file. You can read them in service console or use something like logcheck - Thread about logcheck

[kjb007]

This type of information is not available in the vm properties. There are 3rd party applications that will "tag" this type of information as metadata to the vm, but it does not exist out of the box. We personally edit the vm notes to store this information, along with other pertinent data, but it is a manual process.

-KjB

VMware vExpert

[Box293]

I've opened every file (apart from the hard disk) in the directory that stores the VM.

There is nothing here to indicate who CREATED the VM.

Perhaps this is there day 1 but this is 2 years later I want to find out this information.

[Box293]

vCenter seems to have the information closest to what I am after.

Under Tasks & Events under Tasks the oldest event is Reconfigure Virtual Machine (2 years old).

If this is all the information related to the machine then the oldest event should be "Created Virtual Machine" or deployed or similar.

[kjb007]

Click on the event button, there will be a Virtual Machine created event and will list the username. If you use the vm often, this information does rollover, and does not stay in the tasks&event forever.

-KjB

VMware vExpert

[Box293]

Interesting the oldest item under tasks dates back to 2007-01-15 however under events the oldest item dates back to 2008-11-21.

Must have been rolled over.

[kjb007]

The rollover is the problem. That's why we use the notes field. It's manual, but it works.

-KjB

VMware vExpert

[VillainousWolf]

I know this is an old thread, but the issue is still true today. I have vCenter users creating VMs and not adding notes along with a list of other things and tracking them down without logs is a pain. Also, even if you had logs archived you have to go through them and we all want the easy button.

I found a way to run a python script as an alarm action that adds the creator and timestamp of a VM to the attributes section of the VM itself. So while you are looking at the VM and wonder who to ask questions to, the answer will be right in front of you. I can not take created for the python script, but it works great and I wrote a tutorial on my website to walk you through the steps to get this to work:

https://villainouswolf.com/how-to-add-vm-creator-and-time-created-to-the-attributes-of-a-vm-in-a-vce...

I am not attempting to plug my site as much as I have hit this same thread multiple times in the past hoping someone could come up with a modern solution in regards to the VCSA and this works!

[Ajay1988]

Try the below command on vCSA. Recommendation will be to use PowerCLI/API to VC . 

select CREATE_TIME, USERNAME, VM_NAME, HOST_NAME, DATACENTER_NAME from VPXV_EVENT_ALL where EVENT_TYPE = 'vim.event.VmCreatedEvent';